Bitvise Limited

Suites 41/42, Victoria House 26 Main Street Gibraltar GI +1 869 762 1410 ietf-ssh2@denisbider.com http://www.bitvise.com/

Juniper Networks, Inc.

1194 N Mathilda Av Sunnyvale CA 94089-1206 US +1 408 745 2952 mdb@juniper.net http://www.juniper.net/

This memo defines algorithm names and parameters for use of some of the SHA-2 family of secure hash algorithms for data integrity verification in the Secure Shell (SSH) protocol. It also updates RFC4253 by specifying a new RECOMMENDED data integrity algorithm.

Secure Shell (SSH) is a very common protocol for secure remote login on the Internet. Currently, SSH defines data integrity verification using SHA-1 and MD5 algorithms . Due to recent security concerns with these two algorithms , implementors and users request support for data integrity verification using some of the SHA-2 family of of secure hash algorithms. Please send comments on this draft to ietf-ssh@NetBSD.org.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in .

This memo adopts the style and conventions of in defining new data integrity algorithms.

The following new data integrity algorithms are defined: hmac-sha2-256 RECOMMENDED HMAC-SHA2-256 (digest length = 32 bytes, key length = 32 bytes) hmac-sha2-256-96 OPTIONAL first 96 bits of HMAC-SHA2-256 (digest length = 12 bytes, key length = 32 bytes) hmac-sha2-512 OPTIONAL HMAC-SHA2-512 (digest length = 64 bytes, key length = 64 bytes) hmac-sha2-512-96 OPTIONAL first 96 bits of HMAC-SHA2-512 (digest length = 12 bytes, key length = 64 bytes)

The HMAC mechanism was originally defined in and has been updated in . The SHA-2 family of secure hash algorithms are defined in . Sample code for the SHA-based HMAC algorithms are available in . The variants HMAC-SHA2-224 and HMAC-SHA2-384 algorithms were considered, but not added to this list as they have the same computational requirements of HMAC-SHA2-256 and HMAC-SHA2-512 respectively and do not seem to be much used in practice. The truncated -96 OPTIONAL forms are present to allow applications which may be space restricted to still interoperate and make use of the new hashes. Test vectors for use of HMAC with SHA-2 are provided in . Users, implementors, and administrators may choose to put these new Macs into the proposal ahead of the REQUIRED hmac-sha1 algorithm defined in so that they would be negotiated first.

This document augments the MAC Algorithm Names in and .

IANA is requested to update the SSH algorithm registry with the following entries: MAC Algorithm Name Reference Note hmac-sha2-256 This draft Section 2 hmac-sha2-256-96 This draft Section 2 hmac-sha2-512 This draft Section 2 hmac-sha2-512-96 This draft Section 2

The security considerations of RFC 4253 apply to this document. The National Institute of Standards and Technology (NIST) publications: NIST Special Publication (SP) 800-107 and NIST SP 800-131A suggest that HMAC-SHA1 and HMAC-SHA2-256 have a security strength of 128 bits and 256 bits respectively which are considered acceptable key lengths. Many users seem to be interested in the perceived safety of using the SHA2-based algorithms for hashing.

National Institute of Standards and Technology (NIST), United States of America IBM T.J. Watson Research Center University of California at San Diego IBM T.J. Watson Research Center Harvard University RSA Security SSH Communications Security Corp Cisco Systems, Inc. National Institute of Standards and Technology (NIST) National Institute of Standards and Technology (NIST) SSH Communications Security Corp SSH Communications Security Corp SSH Communications Security Corp Cisco Systems, Inc. IECA, Inc. National Institute of Standards and Technology National Institute of Standards and Technology National Institute of Standards and Technology IECA, Inc. VPN Consortium Huawei AT&T Laboratories